Obtain the expected value safely
Use the official vendor website, signed release notes, package repository, or another authenticated channel. A hash copied from the same untrusted mirror as the file provides little independent assurance.
Confirm the hash corresponds to the exact version, operating system, architecture, and file name you downloaded.
Calculate the local file hash
A browser tool can pass the file bytes to the Web Crypto API without uploading them. Operating systems also provide command-line checksum utilities for very large files.
Hash the final downloaded file before installation or extraction when that is the published comparison point.
Compare the full digest
A SHA-256 digest is normally shown as 64 hexadecimal characters. Compare every character. Uppercase and lowercase hexadecimal letters represent the same value.
A mismatch can result from corruption, a different build, a modified file, or an incorrect expected hash. Download again from the official source and investigate.
Know what a match proves
A match proves that your file bytes correspond to the expected digest. It does not prove the publisher is trustworthy or that the file is free from malware.
Use code signing, trusted distribution, security scanning, and vendor reputation in addition to checksums.
Final review checklist
- Expected hash from trusted source
- Correct version and file selected
- All 64 characters compared
- Mismatch investigated before opening
- Additional security checks used